Add clamping to FontSelectionValue constructor

Fixes casting overflow caught by Clusterfuzz.

Bug: 1099559, 745910
Change-Id: Ia3a18d4e21c7fd9be26c3667a4c160cd7023a213
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2271069
Commit-Queue: George Steel <gtsteel@chromium.org>
Reviewed-by: Dominik Röttsches <drott@chromium.org>
Cr-Commit-Position: refs/heads/master@{#783755}

third_party/blink/renderer/platform/fonts/font_selection_types.h

@@ -48,13 +48,16 @@ class PLATFORM_EXPORT FontSelectionValue {
   FontSelectionValue() = default;
 
   // Explicit because it is lossy.
-  explicit FontSelectionValue(int x) : backing_(x * fractionalEntropy) {}
+  explicit FontSelectionValue(int x)
+      : backing_(clampTo<int16_t>(x * fractionalEntropy)) {}
 
   // Explicit because it is lossy.
-  explicit FontSelectionValue(float x) : backing_(x * fractionalEntropy) {}
+  explicit FontSelectionValue(float x)
+      : backing_(clampTo<int16_t>(x * fractionalEntropy)) {}
 
   // Explicit because it is lossy.
-  explicit FontSelectionValue(double x) : backing_(x * fractionalEntropy) {}
+  explicit FontSelectionValue(double x)
+      : backing_(clampTo<int16_t>(x * fractionalEntropy)) {}
 
   operator float() const {
     // floats have 23 fractional bits, but only 14 fractional bits are